Set up, scan, review, and defend

Orient each role and route readers to the shortest successful path.

Cover first GitHub sign-in, account state, and where settings live.

Explain OAuth versus a fine-grained token, required scopes, storage, rotation, and revocation.

Take a user from authenticated GitHub access to a selected repository and ref.

Explain how environment synthesis is triggered, what it builds, and how readiness is verified.

Cover the first hunt/scan trigger, options, expected stages, and completion signals.

Cover adding repositories, branches/refs, repeated scans, and repository inventory behavior.

Map job and environment states to the pages where users inspect progress, logs, and failures.

Cover cadence selection, pause/resume, last-run state, and schedule failures.

Explain finding groups, evidence, severity, confidence, status, occurrences, and deduplication.

Document that acknowledgement confirms a true positive and immediately starts Defend patch generation; rejection marks a false positive.

Cover acknowledgement-triggered and bundled patch generation, eligibility, progress, generated patches, and revalidation.

Explain the two-step PR request/approval flow, GitHub review, and merge handoff.

Document knowledge cards, appropriate content, lifecycle, and their effect on later scans.

Explain reversible archive controls, filters, and the boundary with deletion.

Define site roles, mapped ownership, delegated org-admin, membership, repo access, named roles, and capability boundaries.

Provide one canonical state map from repository connection through environment, scan, review, defend, PR, and archive.

List GitHub App/OAuth/token permissions, why each exists, and least-privilege alternatives.

Route common install, auth, clone, environment, scan, review, defend, PR, and seat failures.